Re: pv-grub, yeah. The hook that updates the menu.lst is pretty ugly, and specifically looks for *-virtual kernels, assuming that no other kernel could possibly support Xen. Why not grep for the right option in the installed config-$(uname -r)?

Anyway, 3.5.6 -might- fix it, but I only see one particularly obvious candidate commit here:

$ git sl v3.5.5..v3.5.6
73b6448a Linux 3.5.6
3e6e7102 SCSI: scsi_dh_alua: Enable STPG for unavailable ports
7cea6675 SCSI: scsi_remove_target: fix softlockup regression on hot remove
e71704ff x86/alternatives: Fix p6 nops on non-modular kernels
efb238bd isci: fix isci_pci_probe() generates warning on efi failure path
39d6594c IB/srp: Avoid having aborted requests hang
7bc5c2ef IB/srp: Fix use-after-free in srp_reset_req()
e0951902 IPoIB: Fix use-after-free of multicast object
a4edc1f6 remoteproc: fix a potential NULL-dereference on cleanup
df34ee9a remoteproc: select VIRTIO to avoid build breakage
b902acd7 can: mscan-mpc5xxx: fix return value check in mpc512x_can_get_clock()
f191670b SCSI: hpsa: Use LUN reset instead of target reset
e9ba5dbd SCSI: ibmvscsi: Fix host config length field overflow
1a260a55 Yama: handle 32-bit userspace prctl
e66cc3f3 UBI: erase free PEB with bitflip in EC header
905c4404 UBI: fix autoresize handling in R/O mode
03d56491 n_gsm: memory leak in uplink error path
f73fd7d1 n_gsm: added interlocking for gsm_data_lock for certain code paths
fc8cb6c2 n_gsm: uplink SKBs accumulate on list
be5288ab n_gsm.c: Implement 3GPP27.010 DLC start-up procedure in MUX
a4c1d25f coredump: prevent double-free on an error path in core dumper
d4663b9b xen/pciback: Restore the PCI config space after an FLR.
663a6382 ath9k: Disable ASPM only for AR9285
5b537939 HID: keep dev_rdesc unmodified and use it for comparisons
8a5683bd Increase XHCI suspend timeout to 16ms
db01e021 xHCI: handle command after aborting the command ring
3b700e1e xHCI: cancel command after command timeout
ef627393 xHCI: add aborting command ring function
a4b5fb15 xHCI: add cmd_ring_state
f4b6f280 xhci: Intel Panther Point BEI quirk.
18845040 firmware: Add missing attributes to EFI variable attribute print out from sysfs
163449e1 b43legacy: Fix crash on unload when firmware not available
5d553a60 tools/hv: Check for read/write errors
03a933bb tools/hv: Fix exit() error code
0e0ce0ff tools/hv: Fix file handle leak
d776b208 serial: set correct baud_base for EXSYS EX-41092 Dual 16950
c8b202d7 serial: pl011: handle corruption at high clock speeds
2633bff4 serial: omap: fix software flow control
1d1cfe7d TTY: ttyprintk, don't touch behind tty->write_buf
7e67dd66 Remove BUG_ON from n_tty_read()
e83d3154 staging: comedi: fix memory leak for saved channel list
805b1efb staging: comedi: don't dereference user memory for INSN_INTTRIG
449ebcca staging: comedi: jr3_pci: fix iomem dereference
dcfb8c1a staging: comedi: s626: don't dereference insn->data
22011628 staging: r8712u: Do not queue cloned skb
2ce9883d tty: keyboard.c: Remove locking from vt_get_leds.
0d5aa2d2 staging: speakup_soft: Fix reading of init string
c83c0144 USB: serial: fix up bug with missing {}
4ea336b0 usb: host: xhci: Fix Null pointer dereferencing with 71c731a for non-x86 systems
30df0f0b USB: qcaux: add Pantech vendor class match
0dc562e5 USB: ftdi_sio: add TIAO USB Multi-Protocol Adapter (TUMPA) support
367b7898 USB: option: blacklist QMI interface on ZTE MF683
7be04b2e usb: gadget: initialize the strings in tcm_usb_gadget properly
458cf145 usb: gadget: make g_printer enumerate again
476ea1ee dm verity: fix overflow check
bfa27f1c dm table: clear add_random unless all devices have it set
cbd580de dm: handle requests beyond end of device instead of using BUG_ON
a59f3fc5 dm mpath: only retry ioctl when no paths if queue_if_no_path set
d31515d6 vfs: dcache: fix deadlock in tree traversal

The last commit ("vfs: dcache: fix deadlock in tree traversal") looks like the only real possibility if the fix is between v3.5.5 and v3.5.6. The rest of the commits look like they wouldn't affect us at all.